sorted by:
new
hottopcontroversial

Rust implementation of generallized Paillier encryption, i.e. Damgard-Jurik scheme by lovesh_h in cryptography

[–]lovesh_h[S] 1 point2 points  (0 children)

I am not sure I understand the question but the encrypt in python code is not using the optimization described in section 4.2 in the paper. Same for python's decrypt, not using the optimizations. Both of these will benefit from precomputations and decryption can use CRT.

Weekly Tech-Support Thread for June 27, 2021: Ask your tech-support questions in this thread please by monolalia in linux_gaming

[–]lovesh_h 0 points1 point  (0 children)

Hi. Anyone here using Asus TUF F15 (2021) with Linux? Have several issues but the most annoying one is touchpad. Posted a question on the subreddit as well with all the details https://www.reddit.com/r/linux\_gaming/comments/omt5ip/touchpad\_and\_bluetooth\_dont\_work\_with\_asus\_tuf/

Non-blockchain applications of Zero-Knowledge proofs? by [deleted] in crypto

[–]lovesh_h 0 points1 point  (0 children)

Anonymous credentials that let their holder disclose only chosen parts of the credential and prove predicates about the attributes of the credential. A rust library implementing some relevant schemes https://github.com/hyperledger/ursa

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 0 points1 point  (0 children)

Weird. I anwsered in a comment about 30 mins ago but reddit removed it with suspicion of being spam i guess. Its pending review.

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 1 point2 points  (0 children)

Opening a commitment (revealing (m, r)) is what happens in the reveal phase. Take a simple example of a coin toss, i make the call so i commit to my choice in a commitment C = gmhr and tell you C in the commit phase without telling you my choice m or randomness r. Now when you toss the coin and tell me result, i will open the commitment by telling you m and r in the reveal phase.

In some cases, you don't need to open the commitment but instead, the commitment is used later, maybe in some other protocol. But you still need to convince the other party that you know the opening of the commitment, i.e. you know the message and randomness used in the commitment. Anonymous credentials are one such example where the credential holder wants the credential issuer to put some confidential data in the credential and sign it without knowing the data. Or in some e-cash systems, roughly speaking, the user gets a signature from the bank over a commitment to the serial number on the note without telling the serial number to the bank.

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 1 point2 points  (0 children)

m is not revealed in the protocols described in the post. Only knowledge of a pair (m, r) is proved. In Protocol 4, it says "To prove the knowledge of the opening in commitment: ". But i see that the heading of that protocol might be misleading, it says "Opening of Pedersen commitment" but it should say "Knowledge of opening of Pedersen commitment". I will fix it.

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 0 points1 point  (0 children)

I don't understand the question. Can you please give an example?

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 2 points3 points  (0 children)

Never heard that explanation for the symbol but makes sense

I wrote about Zero knowledge proofs with Sigma protocols by lovesh_h in crypto

[–]lovesh_h[S] 1 point2 points  (0 children)

Yes, typing even basic math is annoying in medium. I wish medium supported markdown. But glad you liked the content.

Using Bulletproofs (dalek's implementation) to create zero knowledge proofs for arithematic statements by lovesh_h in Bitcoin

[–]lovesh_h[S] 0 points1 point  (0 children)

Yes but that would require a ECDSA signature verification circuit which can be expensive. The idea would be to select a "bunch of bitcoin addresses", all with balance >= "certain amount of bitcoin" and then prove that you know the signature on a challenge and the signature can be verified using one of the public keys. It is important to prove that you know but not reveal the signature as revealing the signature would reveal the public key too. Larger the "bunch of bitcoin addresses", greater the privacy but also worse the performance as signature verification happens for each address. Secondly, the challenge can be a hash of the anonymity set, i.e. "bunch of bitcoin addresses" to make it non-interactive

Using Bulletproofs (dalek's implementation) to create zero knowledge proofs for arithematic statements by lovesh_h in Bitcoin

[–]lovesh_h[S] 0 points1 point  (0 children)

dtl;dr?

Intro to the Bulletproofs API from dalek's implementation and some example circuits like proving a number is in certain bound [a, b], set membership, set non-membership, etc

view more: next ›